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Abstract 

In this paper, we present a loss-tolerant quantum strong coin flipping protocol with bias 
e w 0.359. This is an improvement over Berlin et al. 's protocol [BBBG08 which achieves a bias 
of 0.4. To achieve this, we extend Berlin et al. 's protocol by adding an encryption step that 
hides some information to Bob until he confirms that he successfully measured. We also show 
using numerical analysis that a we cannot improve this bias by considering a /c-fold repetition 
of Berlin et al. 's protocol for k > 2. 

1 Introduction 

Coin nipping is a cryptographic primitive that enables two distrustful and far apart parties, Alice 
and Bob, to create a random bit that remains unbiased even if one of the players tries to force a 
specific outcome. It was first proposed by Blum |Blu81| and has since found numerous applications 
in two-party secure computation. In the classical world, coin flipping is possible under computational 
assumptions like the hardness of factoring or the discrete log problem. However, in the information 
theoretic setting, it is not hard to see that in any classical protocol, one of the players can always 
bias the coin to his or her desired outcome with probability 1. 

Quantum information has given us the opportunity to revisit information theoretic security in 
cryptography. The first breakthrough result was a protocol of Bennett and Brassard [BB84J that 
showed how to securely distribute a secret key between two players in the presence of an omnipo- 
tent eavesdropper. Thenceforth, a long series of work has focused on which other cryptographic 
primitives are possible with the help of quantum information. Unfortunately, the subsequent re- 
sults were not positive. Mayers and Lo, Chau proved the impossibility of secure quantum bit 
commitment and oblivious transfer and consequently of any type of two-party secure computa- 
tion |May97, ILC97[ DKSWQ7]. However, several weaker variants of these primitives have been 
shown to be possible |HK041 lBCH+08 . 

The case of coin flipping is one of the most intriguing ones. Even though the results of Mayers 
and of Lo and Chau exclude the possibility of perfect quantum coin flipping, it still remained open 
whether one can construct a quantum protocol where no player could bias the coin with probability 
1. A few years later, Aharonov et al. [ATVY00J provided such a protocol where no dishonest player 
could bias the coin with probability higher than 0.9143. Then, Ambainis [AmbOlJ described an 
improved protocol whose cheating probability was at most 3/4. Subsequently, a number of different 
protocols have been proposed |SR0H INS03| IKN04] that achieved the same bound of 3/4. Finally, 
it was shown in |CK09j how to achieve a strong coin flipping with cheating probability using a 
weaker coin flipping primitive developed by Mochon |Moc07| . 
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The results mentioned earlier don't take into account practical issues such as losses, noise or 
other imperfections in the quantum apparatus used. In 2008, Berlin et al. presented a loss-tolerant 
quantum coin flipping with bias 0.4. In this protocol, honest players don't always succeed when 
they perform a measurement (the measurement sometimes abort) but when they do succeed, they 
always output the correct value. This is in contrast with noise tolerance where an honest player could 
perform a measure with a wrong outcome without knowing it. Recently, Aharon et al. [AMS10J 
created a loss-tolerant quantum coin flipping protocol with bias e ~ 0.3975. In another flavor, 
Barrett and Massar [BM04J showed how to do bit-string generation (a weaker notion of coin flipping) 
in the presence of noise. 

In this paper, we continue the study of loss-tolerant quantum coin flipping protocol. We con- 
struct such a protocol with bias e ~ 0.359. To achieve this bias, we extend Berlin et al. 's protocol 
by adding an encryption step that hides some information to Bob as long as he doesn't confirm 
that he successfully measured. Notice that we improve the bias of the protocol by adding only a 
classical layer on top of Berlin et al. 's protocol. Let us emphasize that in this paper we only look at 
information theoretic security and we do not discuss computational security or security in restricted 
models like the bounded-storage or noisy-storage model [DFSS08, WST08J. 

It would be interesting whether to see whether such techniques can be used to deal with loss- 
tolerance in other practical models such as the bounded/noisy storage model. Moreover, finding a 
noise-tolerant quantum coin flipping with information theoretic security and small bias remains an 
interesting open question. 

2 Our work 

We continue [BBBG08j's work and try to create practical quantum coin flipping protocols. As their 
protocol, we ask Alice and Bob to send several copies of single qubit states. Moreover, we don't 
require honest players to have any quantum memories. On the other hand, we consider cheating 
players as being all powerful. 

As explained in [BBBG08J, one of the main difficulties in creating a bit-commitment based coin 
flipping lies in the states you send to Bob. The existence of a conclusive measurement between the 
states sent to Bob allows him to cheat perfectly even if the states are close. Berlin et al. 's protocol 
is of the following form. 

• Alice sends a state a to Bob. 

• Bob measures this state in some basis B (possibly dependent on some of his private coins). If 
Bob successfully measures then they continue the protocol. Otherwise, they start again 

In this protocol, the state a is chosen very carefully such that a cheating Bob cannot take advantage 
of the fact, that he can reset the protocol. This strongly limits the good choices for a. To partially 
overcome this problem, we use the following high-level scheme 

• Alice picks r Er {0, 1} and sends E r {a) where E r is some quantum operation that hides some 
information about a 

• Bob measures in some basis B. If Bob successfully measures then they continue the protocol. 
Otherwise, they start again 

• Alice reveals r and then they continue the protocol 
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While doing this, one must be careful that an honest Bob will still be able to exploit the measurement 
of the encrypted state and that Alice cannot use this to cheat. 

Applying this scheme on a two-fold parallel repetition of Berlin etal's protocol, we show the 
following 

Theorem 2.1 There is a loss-tolerant quantum coin flipping protocol with bias e ~ 0.359 

Notice that without this encryption step extra step, the resulting scheme would not be loss- 
tolerant but the bias would remain the same. 

3 Preliminaries 
3.1 Definitions 

The statistical distance over classical distributions is defined as A({Xj},wo i i}», {^}ie{0,i}™) = 
\ Y.i \ X i ~ Y i\ 

Following [NCOOj, we define the fidelity and the trace distance for any quantum states p,a as 
follows 

D(p,a) = -\a-p\ with \ A\ = VA^A 
F(p,a) = tr{yj ' p l / 2 ap l l 2 ) 
Note that the fidelity is sometimes defined as (tr(\J p 1 / 2 ap 1 / 2 )) 2 . 

For two quantum states p, a such that, p = ^2iPi\i)(i\ an d o = ^2iQi\i)(i\ we have D(p,a) = 
A({Xi}, {Yi}) and F(p, a) = 

Definition 3.1 Let E and F any two ensembles of quantum states and let p any quantum state. 
We define: 

F(p,E) = max F(p, a) 
F(E,F) = max F(a.a') 

Finally, we define a (strong) coin flipping protocol 

Definition 3.2 A coin flipping protocol with bias e consists of instructions given to Alice and Bob 
and an outcome x G {0, 1,-L} (A. corresponds to aborting the protocol) such that 

• If Alice and Bob are honest then Pr[x = 0] = Pr[x = 1] = 1/2 

• For any cheating Alice P\ = max{Pr[x = 0], Pr[x = 1]} < 1/2 + e 

• For any cheating Bob P^ = max{Pr[x = 0],Pr[x = 1]} < 1/2 + e 
For completeness, we also define weak coin- flipping protocols 

Definition 3.3 A weak coin flipping protocol with bias £ consists of instructions given to Alice and 
Bob and an outcome x E {0, 1, _L} (A. corresponds to aborting the protocol) such that 
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• If Alice and Bob are honest then Pr[x = 0] = Pr[x = 1] = 1/2 

• For any cheating Alice Pt = Pr[x = 0] < 1/2 + e 

• For any cheating Bob Pg = Pr[x = 1] < 1/2 + e 

Intuitively, x = corresponds to the fact that Alice wins and x = 1 to the fact that Bob wins. Note 
that a cheating player can win with probability less than 1/2 + £ but can lose with probability 1. 

3.2 Useful facts 

Proposition 3.4 INCOOl For any two states po,Pi and any pure state \(p), we have 

O(po,w)>|^|po|0)-(0|pi|^>| 

Proposition 3.5 /TV COO] For any two states p, a such that p = ^2 i Pi\<pi){4>i\ and a = qi\<fti) (4>i\ , 
we have 

D(p,a)<A({X i },{Y i \) 
Proposition 3.6 fFG99\j For any quantum states p, a, we have 

1 - F(p, a) < D(p, a) < ^l-F 2 (p,a) 
Proposition 3.7 IKNO^ For any quantum states p,ao,a\, we have 

F 2 (p,a ) + F 2 (p,a l ) < 1 + F(a , at) 
Proposition 3.8 \Joz9J$ For any quantum states p,ao,a\, we have 

F 2 (p,Y,^) > ^PiF 2 (p,o-i) 

i i 

Proposition 3.9 \Hel67$ Suppose Alice has a bit c Gr {0, 1} unknown to Bob. Alice sends a 
quantum state p c to Bob. We have 

n [n i 1 / 1 , D (P0,PI) 

Fr[Bob guesses c\ < — H 

4 The protocol 

4.1 Quantum states used 

Consider the two orthonormal basis 0°(A) = {|<#j(A)>, |0?(A)>} and B 1 (X) = {|^(A)), |^(A))} for 
any A £ M with: 

108(a)) = ^|o) + yr^A|i) 

|0?(A)) = VT^A|0)-VX|1) 

and 

|0j(A)) = V\\0) - VT^x\i) 

|0i(A)) = VT^X\0) + ^X\l) 
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corresponds to the encoding of bit c in basis b. 
Finally, we define 



Pc = 2 E l#X#l = Mc)(c\ + (1 - A)|l - c)(l - c| 



4.2 Berlin eto/'s protocol 



Berlin etal's protocol (parameter A omitted) 

1. Alice chooses at random b Er {0, 1} and c Er {0, 1} and sends \4> b c ) to Bob. 

2. Bob chooses b' Er {0, 1} and measures the qubit he receives in basis By . If 
his measurement fails, he announces it to Alice and they repeat the protocol 
from step 1. If the measurement succeeds continue. 

3. Bob picks d Er {0, 1} and sends d to Alice 

4. Alice reveals b, c 

5. If b = b', Bob checks that what he measured corresponds to If it 
doesn't match, he aborts. 

6. The outcome of the protocol is x = c © d. 



This protocol is loss tolerant in the sense that a cheating Bob cannot gain advantage in the 
fact that he can restart the protocol when his measurement fails. This protocol has the following 
security parameters: 



1 p* _ 3 i V /A ( 1 ~ A ) 



2. P* 



A 



By taking A = 0.9, we have P* A = P B = 0.9 and their protocol achieve a bias of 0.4. 
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4.3 Our protocol 



Our protocol 

1. Alice chooses at random 61,62 Gr {0, 1} ; c Gr {0, 1} and r\,T2 €r {0, 1} 
sends two quantum registers \(f>^ r .) for i G {1,2} to Bob. 

2. Bob chooses b' l: b' 2 £r {0,1} and measures each register i he receives in 
basis By . If one of his measurements fails, he announces it to Alice and 
they repeat the protocol from step 1. If the measurement succeeds, Bob 
announces this fact to Alice and they continue. 

3. Alice sends r±,V2 to Bob. 

4. Bob picks d Gr {0, 1} and sends d to Alice 

5. Alice reveals 61, 62, c 

6. For each register i for which 6j = b[, Bob checks that what he measured 
corresponds to |<^0 ri ). If one of the measurements does not match, he 
aborts. 

7. The outcome of the protocol is x = c © d. 



This protocol is closely related to a two-fold parallel repetition of Berlin etaVs protocol. Such a 
repetition would directly improve the bias if we did not require loss tolerance. We add an additionnal 
step in this protocol. Alice hides some information about the state she sends using 2 private bits 
r\ , T2 that she reveals as soon as Bob confirms that he measured successfully. As we will show, this 
makes the protocol loss-tolerant again. 

5 Security proofs 

If Alice and Bob are honest then Bob never aborts and x = c © d is random. We now analyse 
separately cheating Alice and cheating Bob. 

5.1 Cheating Alice 

We consider a cheating Alice and an honest Bob. 

5.1.1 General framework for checking Bob 

The way Bob checks is closely related to the following procedure 

• Alice sends a state a in space y 

• At a later stage, Alice sends a bit i to Bob in space X 

• Bob checks that the first state Alice sends in y is the state for some state 
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We want to show the following: 



Proposition 5.1 

Pr[ Alice passes Bob's test ] < F 2 (a, L) 
where L = {Y.jPi\4>j)(4>j\ ■ T,jPj = 1} 

Proof: Let a the first state in y sent by Alice and let a the state in Xy after Alice reveals 
i. Since Bob immediately measures the register X in the computational basis, there is an state a 
which will give the best cheating probability of the form a = Yli Pi\i) (i\ ® an d 



Pr[ Alice passes Bob's test ] = \\tpi){4>i 



Similarly, if we fix a = where |f2) = -\/Pi\h we get that Pr[ Alice passes Bob's test ] = 

Si HV'i)( ( / , j|| 2 This means that we can suppose w.log that after the last step, the state in Xy is 
pure. 

Let a = where = ^ y/Pi\h Let K subspace of quantum pure states spanned by 

(8) \4>i)}- Let Pk = Y2i ® l^ifiil the projection on subspace K. Bob's check is equivalent 
to projecting on the subspace K. 



Pr[ Alice passes Bob's test 



= tr(P K aP K ) 

= tr(P K \n)(Q\P K ) = max |(0|n)| 2 

\u)eL 

< maxF 2 (Tr*(|tt)(tt|),Tr*|u)H) 
\u)&K 

< max F 2 (a,Try\u)(u\) 

\u)eK 

< F 2 (a,L) since V|n) G K, Tr x \u)(u\ G L 



5.2 Proof of security for cheating Alice 

We consider a cheating Alice and an honest Bob. For the sake of the analysis, we can suppose 
that honest Bob doesnt' have losses when he measures (this does not help Alice). Our protocol 
says that Bob measures each register i in a random basis By and performs a check if this basis 
corresponds to the basis B},. in which Alice encoded c. Similarly, we could say that Bob performs 
this measurement at the very end (still picking b[ at random). In this case, we are in the framework 
of the previous subsection except that with some probability, Bob chooses the wrong basis and does 
not check anything. 

Suppose Alice wants to reveal c in our protocol. Let £ the state in Xy she sends at state 1. Let 
= Tryt and £r = Tr x £ Let L c = Pi\4) 
We have the following cases: 

• Bob flipped b\ ^ b\ and b' 2 ^ 62- Bob does nt check anything Alice successfully reveals c with 
probability 1. 



Bob flipped b\ = bi and b' 2 7^ 62- Bob checks the first register. From Proposition 5.1 Alice 
successfully reveals c with probability no greater than F 2 {^x, L c ). 
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Bob nipped ^ b\ and b' 2 = &2- Bob checks the second register. Similarly, Alice successfully 
reveals c with probability no greater than _F 2 (£y,L c ). 

Bob flipped b\ = b\ and b' 2 = 62 ■ Bob checks both registers. In the same way, Alice successfully 
reveals c with probability no greater than -F 2 (£, Lf 2 ). 



This gives us 
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Pr[ Alice successfully reveals c] = ^ (l + F 2 (£ x , L c ) + F 2 (£ Y , L c ) + F 2 (£, L c ®2)) 

We will now need the following Lemma 
Lemma 5.2 

F(L ,L 1 )<2y/X(l-X) 

Proof: Let po G Lq and pi G Li such that F(po,pi) = F(Lq, Li). By definition of Lq, we have 



(0|po|0) = A and (0|pi|0) = 1 — A. This gives us D(po, p\) > 2A — 1. Using Proposition 3.7 we have 

F(po,Pi) < Vl-D 2 (po,pi) 

< v 7 ! - 4A 2 + 4A - 1 

< 2y/X(l -A) 

■ 

We can now prove our main statement 
Proposition 5.3 



2 



2 2 V 2 / 

w/iere /(A) = 2y / A(l - A) 

Proof: We suppose w.log that Alice wants final outcome x = 0. This means that she has to 
reveal c = d . Let £ the state sent by Alice and let £x = Try£ and £x = Tr^£. Since d is random, 
we have 

P\ = - Pr[ Alice successfully reveals c] 

ce{o,i} 

ce{o,i} 

< - (2 + l + Fpo,^!) + 1 + F(D Q ,D 1 ) + 1 + F(DD ,DD 1 )) (Proposition 

o 

< 1 -+ 1 -(\+ 1 -f(d ,d 1 ) + \f 2 (d ,d 1 ) 



3.6) 



1 . 1 n + f(x)\ 



2 



< 2 + 2 ( 2 J (/( A )> ^(^0,^1) from Lemma 



5.2) 
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5.3 Cheating Bob 



The main part here is to show the loss-tolerance of the protocol. This means that a cheating 
Bob cannot take advantage of the fact that he's allowed to reset the protocol in case one of his 
measurements failed. 

5.4 Cheat Sensitivity 

For a fixed c and r\,r2, let ^c 1 ^ 2 sent by Alice. We have 

bl,&26{0,l} 
= Pc0ri <8> Pc®r 2 

Yl Pc® ri , C( Br 2 \u,v}(u,v\ 
u,v£{0,l} 

where: if x = y then p v x = A ; if x / y then p% = 1 - A and p^i.cera = PoSn ■ Pl®r 2 - 
When receiving £, Bob performs a quantum operation 

A(\u,v}) = a UtV \ip U!V }\0)o + Pu >|l>o 

where is the space that Bob measures to determine whether he should announce that he succeeded 
the measurement or not. The outcome in space O corresponds to the outcome where the protocol 
continues. In a way, the cheating Bob postselects on the outcome being since if he obtains 1, he 
decides to start the protocol again. Once Bob successfully measured and after Alice sends r\,r2, 
Bob has the following state depending on the operation A he performed averaging on r±,V2- 

^ = ^ Y Pc®r u c(Br 2 r u,v\ r l^2,^u,v){ri,r2,1pu,v\ 
ri,r 2 e{0,l} 

u,ve{o,i} 

where 

• The r u „'s are arbitrary real numbers. These numbers depend on the a u v 's. We assume that 
Bob can choose any value for these numbers. 

• The \ip u ,v)' s are n °t necessarily orthogonal. 

• S is a normalization factor. 

Proposition 5.4 VA, D(tf,g) < £>(£ ,£i) where £ c = pf 2 . 
Proof: Let's fix A. We have 

\ri,r 2 ,ipu,v)(ri,r2,il>u,v\, p ien , i®r 2 V ^ I r i ' r 2 > ^u,v > (n , r 2 , ip u , v I ) 

n,r 2 e{o,i} n,r 2 6{o,i} 
u,ve{o,i} u,ue{o,i} 
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from convexity of the statistical distance (Proposition 3.5) , we have 



n,?;e{0,l} u,-ue{0,l} , 



< — \n u ' v r - r) u,v r I 

n,»*2e{o,i} 
u,ue{o,i} 

< — V \n u > v -n u,v I 

u,u ri,J"2 

To calculate this sum, if (n, T2) = (it, u) then p"i"r 2 = A 2 an d Pi® n ie r2 = (1— A) 2 . If (n, = (it, v) 
then Pri^ra = (1 - A) 2 and Pi® rii i er2 = A 2 . In the other cases, Pr'Zri = Pi® ri ,i®r 2 - Tnis & ives us 



D(tf,g) < ^^2r^(A 2 -(l-A) 2 ) 



25 

u,v 

< 2A - 1 

Since, £ c = X 2 \cc)(cc\ + A(l - A)(|01)(01| + 1 10> <10|) + (1 - A) 2 |c c)(c c|, we have £>(£ ,£i) = 
(A 2 — (1 — A) 2 ) = 2A — 1, which allows us to conclude. I 

We can now prove our main Claim 
Proposition 5.5 P% < X 

Proof: Suppose w.log that Bob wants outcome x = 0. He wants to pick d = c. Before picking c', 
he has the state £^ . We have 

Pg = Pr[ Bob guesses c] 

2 2 

< A 



Theorem 5.6 There is a loss-tolerant quantum coin flipping protocol with bias e ~ 0.359 

Proof: We just need to find A that minimizes max(P5 3 Pg). The maximum is achieved for 
A » 0.859 which gives P* A = P* B ra 0.859 which gives a bias e » 0.359. ■ 

6 Further discussion 

Optimality of the bias The bias that we show here is actually not optimal for the protocol. 



The reason is the following: in the analysis of cheating Alice (Section 5.2), we consider the cheating 
probability for Alice depending on whether Bob checks the first bit, the second bit or both bits. For 
each of these cases, we upper bound Alice's cheating probability. But it appears that the cheating 
probabilities for each of these cases is different and that Alice cannot cheat optimally for all these 
cases at the same time. This slightly decreases Alice's cheating probability. We can numerically 
calculate calculate in this case that for A ~ 0.858, we have P\ = Pg ~ 0.858. This gives a bias of 
£ ~ 0.858 which is a slight improvement over what is shown. 
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Multiple repetition Our protocol consists of a two-fold repetition of Berlin et al. 's protocol. 
What happens if we consider a /c-fold repetition? Even if it is difficult to calculate the exact cheating 
probabilities of Alice and Bob in the case of multiple repetitions, these probabilities can be easily 
upper and lower bounded. We use the following bounds. Let P^(k,X) the cheating probability 
for Alice (resp. Bob) with a fc-fold repetition of Berlin et al. 's protocol with parameter A. Let 
P(k) = min \(m&x{P^(k, A), Pg(k, \). P{k) corresponds to the best cheating probability when 
consider a fc-fold repetition of the protocol. We need to lower bound P\{k, A). We have 



This is a generalization of the upper bound we use to show that e ~ 0.359. Intuitively, this 
corresponds to the case where Alice knows if Bob measured in the correct basis' or not. When we 
consider Alice's cheating strategies where she uses separate (non entangled) strategies for each of 
the k repetitions, we have the following lower bound. 



Using these bounds, we get the following diagram for cheating probabilities of Alice and Bob which 
shows that the optimal value is achieved using a 2-fold repetition of the protocol. The x-axis corre- 
sponds to the number of repetition k. The y-axis corresponds to the minimal cheating probability 
P(k) when using lower/upper bounds for P\. 




Pl(k,X)>g{k,X) = {\ + 






2 



4 
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| Upper Bound Lower Bound Optimal Value| 
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7 Conclusion and open questions 



In this work, we presented a loss-tolerant quantum coin flipping protocol with bias e « 0.359. To 
do this, we presented a general method to disallow cheating Bob to take advantage of the fact that 
he can reset the protocol when one of his measurement fails. It would be interesting to see whether 
such techniques can be used for other protocols which have information theoretic security or not. 
Moreover, what is the best bias that can be achieved for such loss-tolerant protocols and can such 
protocols also be noise-tolerant? 
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